System and method for assessing cybersecurity awareness

1. A system, comprising:

a monitoring agent, configured to automatically monitor usage of a computing device by a user; and

a processor, configured:

to receive an input that includes a type of cyber-security attack,

to compute a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;

to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user with respect to the type of attack, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and

to generate an output indicative of the score.

2. The system according to claim 1 , wherein the monitoring agent comprises a network probe configured to monitor the usage of the computing device by monitoring network traffic exchanged with the computing device.

3. The system according to claim 1 , wherein the monitoring agent comprises a software agent installed on the computing device.

4. The system according to claim 1 , wherein the processor is configured to compute the score by:

recommending a simulated cyber-security attack, and

computing the score, based on a response of the user to the simulated attack.

5. The system according to claim 1 , wherein the processor is configured to compute the score by computing, using the weightings, a weighted sum of the coefficients.

6. The system according to claim 1 , wherein the processor is configured to use a machine-learned model to compute the characteristic vector of coefficients.

7. A method, comprising:

receiving an input that includes a type of cyber-security attack;

using a monitoring agent, automatically monitoring usage of a computing device by a user;

computing a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;

based on the monitoring, computing a score indicative of a cyber-security awareness of the user with respect to a type of attach, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to the type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and

generating an output indicative of the score.

8. The method according to claim 7 , wherein monitoring the usage of the computing device comprises monitoring the usage of the computing device by monitoring network traffic exchanged with the computing device.

9. The method according to claim 7 , wherein the monitoring agent includes a software agent installed on the computing device.

10. The method according to claim 7 , wherein computing the score comprises:

recommending a simulated cyber-security attack, and

computing the score, based on a response of the user to the simulated attack.

11. The method according to claim 7 , wherein computing the score comprises computing the score by computing, using the weightings, a weighted sum of the coefficients.

12. The method according to claim 7 , wherein computing the characteristic vector of coefficients comprises using a machine-learned model to compute the characteristic vector of coefficients.

13. The method according to claim 7 , wherein computing the characteristic vector of coefficients comprises computing the characteristic vector of coefficients by mapping a plurality of features, obtained from the monitoring, to the coefficients.

14. The method according to claim 13 , further comprising, prior to computing the characteristic vector:

using the monitoring agent, by monitoring at least one user, obtaining a first plurality of features,

by monitoring the at least one user using a monitoring technique that is not used by the monitoring agent, obtaining a second plurality of features, and

calibrating the mapping such that a characteristic vector of coefficients mapped from the first plurality of features is within a threshold of similarity of a characteristic vector of coefficients mapped from the second plurality of features.

15. The method according to claim 13 , further comprising, prior to computing the characteristic vector, calibrating the mapping, by:

using characteristic vectors of coefficients obtained from the mapping, computing respective scores, for a plurality of users, that indicate awareness of the users with respect to a particular type of cyber-security attack, and

checking a correlation between the scores and respective responses of the users to a simulated attack of the particular type.